Questions include the types of data lost, such as names, health records, banking information, and others, the type of compliance regulations (or best practices) the business is subject to, I was subject to (or just best practices), and number of records lost.